Comment by vesinisa | Hacker News Reader

Comment by vesinisa | Hacker News Reader

Parent Full thread

A few years back, I was assigned to work at a BigCorp's premises. They had really tight network security: all outward connections were blocked except through a dedicated HTTP proxy. This was bad news, since stuff like SSH are absolutely essential in my job.

After few days of mobile tethering, I realized I could ask their HTTP proxy to open an HTTPS connection to a server outside the network, but instead of sending HTTPS traffic through the proxy, I could send any traffic - like SSH. With this, I was ultimately able to open an SSH-tunnel to my own shell server running OpenVPN outside their network, which then allowed a (surprisingly stable and fast) access to the internet at wide – via an OpenVPN-tunnel wrapped in an SSH-tunnel pretending to be an HTTPS-tunnel.

I don't recall whether ICMP was allowed out at the BigCorp., but I am pretty sure someone will one day find a tool like this quite useful in a similar situation.. :)

Sounds like they enabled HTTP CONNECT without limiting the accepted port range, so any protocol will go through.

Maybe this is why Microsoft Azure never allowed ICMP travseral through their outer firewall despite frequent request from users....

It's common to run OpenVPN on TCP port 443 (HTTPS) to avoid such restrictions.

The Great China Firewall and others need deep packet inspection, heuristics and AI to find tunnels set up that way.

Blocking based on port is a silly thing. He probably just ran ssh on port 443 to get around it.

That's another possibility, the comment above can be interpreted either way.

In any case they were probably running something like squid with very basic level 7 filtering, so if something comes on 443 they have no option but to forward it.

I think they allowed HTTP CONNECT to any port. Not that it would have been hard to move OpenVPN or SSH to a different port.

My school blocks all protocols except for HTTP and HTTPS. However they actually MITM HTTPS connections (I have to install a root certificate from them) so they can decrypt and see everything people do. So unfortunately typical TCP proxies don't work, even on port 443 as their transparent proxy makes the handshake. Instead, I have to put the payload in an HTTP request acting as a download, and another request as an upload, and make an OpenVPN connection over that.

That should be criminal, requiring users to install a root cert is just sad.. nice workaround though!

My university uses a HTTP proxy too. The proxy makes connections only on ports 80 and 443. So, OpenVPN on port 443 is pretty much the only option. Wish Google Hangout would work over HTTPS.

Reply on news.ycombinator.com